Jamf Protect - Alerts

Back


Id	6098daa0-f05e-44d5-b5a0-913e63ba3179
Rulename	Jamf Protect - Alerts
Description	Creates an incident based on Jamf Protect Alert data in Microsoft Sentinel
Severity	High
Required data connectors	JamfProtect
Kind	NRT
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Jamf Protect/Analytic Rules/JamfProtectAlerts.yaml
Version	1.0.6
Arm template	6098daa0-f05e-44d5-b5a0-913e63ba3179.json

KQL

jamfprotectalerts_CL
| extend
    algorithm = "SHA256",
    Host_IPs = tostring(parse_json(DvcIpAddr)[0]),
    Tags = parse_json(tostring(parse_json(tostring(input.match)).tags)),
    Tactics = case(input.match.tags has "Execution", "Execution", input.match.tags has "Visibility", "Visibility", input.match.tags has "Persistence", "Persistence", input.match.tags has "LateralMovement", "LateralMovement", input.match.tags has "CredentialAccess", "CredentialAcccess", input.match.tags has "DefenseEvasion", "DefenseEvasion", input.match.tags has "PrivilegeEscalation", "PrivilegeEscalation", input.match.tags has "Impact", "Impact", input.match.tags has "CommandAndControl", "CommandandControl", input.match.tags has "Discovery", "Discovery", input.match.tags has "InitialAccess", "InitialAccess", ""),
    Techniques = pack_array(extract(@"[A-Za-z]\d{4}", 0, tostring(input.match.tags))),
    JamfPro = case(input.match.actions has "SmartGroup", "Workflow with Jamf Pro", input.match.actions has "Prevented", "No workflow, Prevented by Protect", "No workflow")

YAML

name: Jamf Protect - Alerts
alertDetailsOverride:
  alertDynamicProperties:
  - value: EventVendor
    alertProperty: ProviderName
  - value: EventProduct
    alertProperty: ProductName
  - value: Techniques
    alertProperty: Techniques
  alertDisplayNameFormat: '{{EventMessage}} detected on {{DvcHostname}}'
  alertTacticsColumnName: Tactics
  alertSeverityColumnName: EventSeverity
  alertDescriptionFormat: '{{EventResultMessage}} - Please investigate'
entityMappings:
- fieldMappings:
  - columnName: DvcHostname
    identifier: HostName
  - columnName: DvcOs
    identifier: OSFamily
  - columnName: DvcOsVersion
    identifier: OSVersion
  entityType: Host
- fieldMappings:
  - columnName: Host_IPs
    identifier: Address
  entityType: IP
- fieldMappings:
  - columnName: TargetProcessCurrentDirectory
    identifier: CommandLine
  - columnName: TargetProcessId
    identifier: ProcessId
  entityType: Process
- fieldMappings:
  - columnName: algorithm
    identifier: Algorithm
  - columnName: TargetBinarySHA256
    identifier: Value
  entityType: FileHash
id: 6098daa0-f05e-44d5-b5a0-913e63ba3179
description: |
    'Creates an incident based on Jamf Protect Alert data in Microsoft Sentinel'
suppressionEnabled: false
version: 1.0.6
query: |
  jamfprotectalerts_CL
  | extend
      algorithm = "SHA256",
      Host_IPs = tostring(parse_json(DvcIpAddr)[0]),
      Tags = parse_json(tostring(parse_json(tostring(input.match)).tags)),
      Tactics = case(input.match.tags has "Execution", "Execution", input.match.tags has "Visibility", "Visibility", input.match.tags has "Persistence", "Persistence", input.match.tags has "LateralMovement", "LateralMovement", input.match.tags has "CredentialAccess", "CredentialAcccess", input.match.tags has "DefenseEvasion", "DefenseEvasion", input.match.tags has "PrivilegeEscalation", "PrivilegeEscalation", input.match.tags has "Impact", "Impact", input.match.tags has "CommandAndControl", "CommandandControl", input.match.tags has "Discovery", "Discovery", input.match.tags has "InitialAccess", "InitialAccess", ""),
      Techniques = pack_array(extract(@"[A-Za-z]\d{4}", 0, tostring(input.match.tags))),
      JamfPro = case(input.match.actions has "SmartGroup", "Workflow with Jamf Pro", input.match.actions has "Prevented", "No workflow, Prevented by Protect", "No workflow")  
tactics: 
suppressionDuration: PT5H
kind: NRT
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Jamf Protect/Analytic Rules/JamfProtectAlerts.yaml
severity: High
incidentConfiguration:
  createIncident: true
  groupingConfiguration:
    lookbackDuration: PT5H
    reopenClosedIncident: false
    matchingMethod: AllEntities
    enabled: false
requiredDataConnectors:
- dataTypes:
  - jamfprotectalerts_CL
  connectorId: JamfProtect
status: Available
customDetails:
  TargetBinarySigner: TargetBinarySigningTeamID
  TargetBinarySignMsg: TargetBinarySigningInfoMessage
  Related_Binaries: TargetBinaryFilePath
  Protect_Event_Type: EventType
  Related_File_hash: TargetBinarySHA256
  TargetbinarySign: TargetbinarySignerType
  Protect_Analytic: EventMessage
  JamfPro_Status: JamfPro
  Protect_Tags: Tags
eventGroupingSettings:
  aggregationKind: AlertPerResult
relevantTechniques:

ARM